Talos IR Trends: How to Detect & Block IT Help Desk Vishing

Executive Summary

Cisco Talos Incident Response (CTIR) published its quarterly threat landscape intelligence report for Q3 2026, documenting significant operational shifts in adversary initial access techniques and ransomware execution. Phishing retained its position as the premier intrusion vector, accounting for more than one-third of all Talos IR engagements. Most notably, analysts recorded a sharp escalation in voice phishing (vishing) attacks where threat actors directly phone enterprise personnel while impersonating corporate IT help desk or support technicians.

By combining telephone-based social engineering with executive urgency, adversaries convince employees to bypass security warnings and authorize remote access via legitimate Remote Monitoring and Management (RMM) software—such as AnyDesk, TeamViewer, and ConnectWise ScreenConnect. Concurrently, public-facing application and edge appliance exploitation represented another third of intrusions. Ransomware and extortion remained the dominant final objective in over 40 percent of engagements, underscoring that human-driven social engineering remains the most lethal catalyst for enterprise ransomware deployment.

---

Malware Execution Mechanics & Attack Chain

Ingress, Help Desk Vishing & RMM Weaponization

Adversaries execute vishing campaigns with meticulous reconnaissance, gathering corporate employee directories, internal organizational hierarchies, and IT terminology from public profiles. The threat actor places an unscheduled voice call to the targeted worker, claiming to be an IT support engineer responding to a critical security alert or performing a mandatory system software update.

Under the guise of troubleshooting, the operator instructs the victim to navigate to a legitimate remote support portal or download an authorized RMM client. Because commercial RMM binaries are cryptographically signed by legitimate software vendors, endpoint detection and response (EDR) agents and antivirus engines typically permit execution without generating alerts. Once the victim accepts the connection prompt, the adversary gains interactive desktop control over the internal workstation, establishing encrypted outbound command-and-control communication over standard TLS port 443.

Credential Harvesting, Lateral Movement & Ransomware Climax

With an interactive foothold secured, the threat actor operates directly within the authenticated user's session:

1. Token & Credential Extraction: Dumps stored browser passwords, session cookies, and Active Directory tokens from local memory using native utilities.
2. MFA Push Fatigue & Session Hijacking: Requests legitimate authentication approvals, coaching the employee over the phone to accept multi-factor authentication (MFA) prompts.
3. Internal Subnet Pivoting: Uses native Windows administration commands (net.exe, nltest.exe, PowerShell) to map domain controllers and locate sensitive data shares.
4. Data Exfiltration & Extortion Deployment: Stages intellectual property to cloud storage and executes ransomware across network shares, terminating volume shadow copies via vssadmin delete shadows /all /quiet.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Attribution

Talos telemetry attributes the surge in IT help desk vishing campaigns primarily to financially motivated cybercrime syndicates and specialized initial access brokers (IABs). Groups associated with the Scattered Spider / UNC3944 ecosystem and ransomware affiliates deploying Akira and BlackCat/ALPHV heavily leverage voice social engineering against corporate help desks. By targeting identity providers (IdPs) and exploiting human trust, these adversaries reliably bypass millions of dollars in perimeter defensive hardware.

---

SOC Defense & Incident Response Playbook

1. Verification Protocols & Help Desk Hardening

• Establish Out-of-Band Call Verification: Enforce a mandatory callback policy for all internal IT support requests. Require technicians and employees to verify identity through internal authenticated messaging channels (Slack, Microsoft Teams) or dedicated challenge-response codes before granting remote access.
• Strict RMM Application Allowlisting: Implement application control policies (AppLocker or Windows Defender Application Control) to block unauthorized execution of non-standard RMM tools (AnyDesk, TeamViewer, Splashtop, UltraVNC). Permit only the single designated enterprise-standard RMM tool.
• Enforce Phishing-Resistant MFA: Transition from SMS and push notification MFA to FIDO2 / WebAuthn hardware security keys, which are impervious to vishing-based token harvesting and push fatigue.

2. Perimeter C2 Severance & Network Auditing

• Block outbound connections from workstation subnets to known commercial RMM relay domains unless specifically required by the corporate IT team.
• Monitor corporate VPN and IdP authentication logs for concurrent logins originating from disparate geographic locations or residential proxy IP blocks.

3. Behavioral Detection & Hunting Query

Sigma Rule: Unauthorized Remote Monitoring Tool Execution

title: Unauthorized Remote Management Tool Execution
id: d7f1a3e9-0b42-4f91-8812-rmm-vishing-exec
status: experimental
description: Detects execution of common remote access and support tools indicative of vishing or unauthorized control.
references:
  - https://blog.talosintelligence.com/ir-trends-q3-2026/?ref=cybernewsai.com
author: CyberNewsAI Threat Research Team
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\ScreenConnect.Client.exe'
      - '\AteraAgent.exe'
      - '\Splashtop.exe'
  condition: selection
level: high
tags:
  - attack.initial_access
  - attack.t1566.004
  - attack.t1219

Microsoft Sentinel / Defender Hunting Query (KQL)

// Hunt for unauthorized RMM software process creation on standard employee workstations
DeviceProcessEvents
| where FileName in~ ("AnyDesk.exe", "TeamViewer.exe", "ScreenConnect.Client.exe", "AteraAgent.exe", "Splashtop.exe")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by TimeGenerated desc

---

Enforce strict application whitelisting for RMM software; train employees on voice phishing verification procedures.